It explains spam placement
Authentication failures and spam scores in the header are often the precise reason a message was filtered.
Free Email Tool
Email Header Analyzer
Every email carries a hidden header that records where it came from, how it travelled and whether it passed authentication. Read correctly, it explains why a message went to spam or was delayed. This guide shows you what to look for — and a specialist will read yours for you, free.
Information:
Automated checker coming soon
What this tool checks
What an email header reveals.
A header analysis turns a wall of technical text into a clear story. These are the parts that matter most.
-
Authentication results
Whether the message passed SPF, DKIM and DMARC — the checks that prove it genuinely came from its claimed sender.
-
The routing path
The "Received" lines trace every server the message passed through, from origin to your inbox.
-
Delays at each hop
Timestamps on each hop reveal where a message was held up, so you can see why it arrived late.
-
Spam and filtering clues
Spam-score headers and filter verdicts show how the receiving system judged the message.
-
The real sender
The header distinguishes the visible "From" from the actual sending server — a key tell for spoofing.
-
Misconfiguration hints
Unusual hops, mismatched domains or failed checks often point straight at a setup problem worth fixing.
Why it matters
The header is where the answer hides.
When mail goes to spam, arrives late, or looks suspicious, the header usually contains the explanation — if you know how to read it.
It pinpoints delays
Hop-by-hop timestamps show exactly where a slow message was held up, instead of guessing.
It exposes impersonation
A header reveals when the real sending server does not match the visible address — a hallmark of a spoofed or phishing email.
Common problems
What headers most often reveal.
When we read a header for a customer, the cause of their problem is usually one of these. Reading it correctly is the hard part.
-
Failed authentication
SPF, DKIM or DMARC failures in the header explain why a genuine message was treated as suspicious and filtered.
-
A suspicious routing path
Unexpected servers or countries in the Received lines can indicate spoofing, relaying or a compromised account.
-
A long delay at one hop
A single slow server in the chain accounts for most "why was this email so late?" questions.
-
A header that is hard to read
Raw headers are dense and easy to misread — the wrong conclusion sends you fixing the wrong thing.
Preview the analyzer
Paste an email header
This is a preview of the automated header analyzer we are building. It does not parse, analyse or store anything you paste.
Coming soon
Automated checking is on its way. A human audit is available now.
We are building instant, automated checkers as part of our Email Operations Center roadmap. Until then, a specialist will run this check by hand as part of a free Email Audit — and explain what it means for your business in plain English, with no jargon and no obligation.
- A real specialist reviews your setup — not an automated guess.
- Plain-English findings and the next step that actually matters.
- Free, with no obligation — we work alongside your existing IT.
Questions
Answers, in plain English.
What is an email header?
An email header is the hidden technical record attached to every message. It logs the sender, every server the message passed through, the timestamps of each hop, and the results of authentication checks like SPF, DKIM and DMARC — the full story behind a message.
How do I find an email's header?
In most mail apps it is under an option like "show original", "view source" or "view message details" on the individual message. That reveals the raw header text — the part an analyzer reads. We can walk you through it for your specific mail client.
Can a header tell me why my email went to spam?
Often, yes. The header records authentication results and frequently a spam score or filter verdict from the receiving system, which together usually reveal the precise reason a message was filtered — the starting point for fixing it.
Can a header prove an email was spoofed?
It is one of the strongest clues. When the real sending server in the header does not match the visible From address, or authentication failed, that is a classic sign of spoofing or phishing — which our Email Security service is built to stop.
Does this tool analyse my header live?
Not yet — the automated analyzer is in development. This page explains what a header reveals and how to read it, and the form is a preview that does not parse or store anything you paste. For results today, request a free manual audit.
Is it safe to paste a header here?
This form does not submit, parse or store anything — it is a static preview. As a general habit, paste only the raw header, never passwords or private message content. When you request a manual audit, we tell you exactly what to send.